Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large DDoS hitting CloudFlare

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 34 posts

Re: Large DDoS hitting CloudFlare

#21

Post by fnordfnordfnord »

joshfraser wrote: post #15

This is why most CDNs avoid taking on controversial customers like 4chan, kaddafi.hk and other sites trafficking in illegal content. Due to their decision to accept anyone, Cloudflare is a constant target for DDOS attacks and their legitimate users occasionally share the brunt of those attacks.

4chan "trafficking in illegal content"? I don't think that's a fair assessment. They specifically censor much less than most website operators but they aren't "trafficking" any more than highway underpasses "traffic" in illegal graffiti.

Re: Large DDoS hitting CloudFlare

#23

Post by joshfraser »

fnordfnordfnord wrote: post #21
joshfraser wrote: post #15

This is why most CDNs avoid taking on controversial customers like 4chan, kaddafi.hk and other sites trafficking in illegal content. Due to their decision to accept anyone, Cloudflare is a constant target for DDOS attacks and their legitimate users occasionally share the brunt of those attacks.

4chan "trafficking in illegal content"? I don't think that's a fair assessment. They specifically censor much less than most website operators but they aren't "trafficking" any more than highway underpasses "traffic" in illegal graffiti.

I was referring more to the numerous sites they host like kaddafi.hk which sells stolen credit cards online. 4chan has a recurring problem with child porn (which their moderators do their best to prevent), but I agree with your distinction regarding trafficking.

Re: Large DDoS hitting CloudFlare

#24

Post by pavel_lishin »

csense wrote: post #22

Is there an economic incentive for DDoS attacks? Or is it just some bored script kiddie with nothing better to do?

My theory is that some of them are proof-of-concept attacks: "We took down X for forty eight hours; give us $Y and we'll do the same to anyone you name."

Re: Large DDoS hitting CloudFlare

#25

Post by CrowderSoup »

PhasmaFelis wrote: post #11
callesgg wrote: post #3

We would people try to do a ddos on them. A ddos is a temporary thing. Only time it is worth it do do a ddos is when there is some kind of event thing. Like if some one wants to get a site down today so people can't vote. And cloudflare does not really have anything like that. Their customers yes, them no.

> We would people try to do a ddos on them. The same reason anyone ever DDOSes anything: because they're assholes.

This is the most succinct and accurate assessment of anyone who DDOSSes anything.

Re: Large DDoS hitting CloudFlare

#26

Post by tmarman »

crystaln wrote: post #14

CloudFlare, a product supposed to increase uptime, has been my product's only source of downtime for the past several months.

CloudFlare also caused huge performance issues on a side project which I didn't notice until recently. I was consistently getting 1.2s+ responses on a couple of pages, and 600ms on a completely static page.

So, not only did CloudFlare not help on the pages that were truly static, it was actually making everything worse across the board. Hitting the same site with my direct.* DNS cut from 1.2s+ to under 500ms.

CopperEgg and others also kept reporting that my site was down or otherwise super slow when on CloudFlare. I'm not sure if this is because of throttling or something else that might have been in place with the CF service, but either way I was often unable to reproduce the "down"/"more than 6s" that CopperEgg kept reporting.

In short, I think CloudFlare's services sound good in theory, but I'm not sure they have figure out all the issues with scaling and performance yet. So, I cut them out... and certainly not going to be paying any time soon.

Re: Large DDoS hitting CloudFlare

#27

Post by erichocean »

dsl wrote: post #13
toomuchtodo wrote: post #5

I would kill for a Null Route REST API at peering points/network upstream providers.

The reason the internet is still online is because people who would ask for this type of thing don't have access to it. Routers shouldn't speak HTTP. People who don't know how to use blackhole communities have no business controlling them.

People who don't know how to use blackhole communities have no business controlling them.

What's a "blackhole community"? (I did Google, but found email messages from 2003 on page one. Surely there are better references?)

Re: Large DDoS hitting CloudFlare

#28

Post by toomuchtodo »

dsl wrote: post #13
toomuchtodo wrote: post #5

I would kill for a Null Route REST API at peering points/network upstream providers.

The reason the internet is still online is because people who would ask for this type of thing don't have access to it. Routers shouldn't speak HTTP. People who don't know how to use blackhole communities have no business controlling them.

Your routers wouldn't speak HTTP. Your web service endpoint would talk to your network management middleware, which would then issue your respective IOS/NXOS/JunOS commands to your core or edge gear.

You'd grant your customers the ability to null route traffic from IP blocks (/24 or larger, because ain't nobody got memory to route blocks smaller than that in IPv4) so they wouldn't saturate their links with useless traffic. There was a discussion on the North American Network Operators Group (NANOG) mailing list a few weeks ago.

Disclaimer: I have operated large-scale networks for over a decade.

Re: Large DDoS hitting CloudFlare

#29

Post by toomuchtodo »

erichocean wrote: post #27
dsl wrote: post #13

Earlier quoted context omitted.

The reason the internet is still online is because people who would ask for this type of thing don't have access to it. Routers shouldn't speak HTTP. People who don't know how to use blackhole communities have no business controlling them.

People who don't know how to use blackhole communities have no business controlling them. What's a "blackhole community"? (I did Google, but found email messages from 2003 on page one. Surely there are better references?)

https://www.nanog.org/meetings/nanog32/presentations/soricel...

Re: Large DDoS hitting CloudFlare

#30

Post by erichocean »

toomuchtodo wrote: post #29
erichocean wrote: post #27

Earlier quoted context omitted.

People who don't know how to use blackhole communities have no business controlling them. What's a "blackhole community"? (I did Google, but found email messages from 2003 on page one. Surely there are better references?)

https://www.nanog.org/meetings/nanog32/presentations/soricel...

Thank you, commenters like you are why the HN community rocks.
Post reply on HN